CVE-2026-59083

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.23 Apache Tomcat versions 10.1.0-M1 through 10.1.56 Apache Tomcat versions 9.0.0.M1 through 9.0.119 Apache Tomcat versions 8.5.0 through 8.5.100

Description Improper handling of URL encoding (Hex Encoding) in the rewrite valve allows for a security constraint bypass in certain configurations. Real-world offensive activities targeting this issue have been identified.

Recommendations Upgrade versions 11.0.0-M1 through 11.0.23 to 11.0.24. Upgrade versions 10.1.0-M1 through 10.1.56 to 10.1.57. Upgrade versions 9.0.0.M1 through 9.0.119 to 9.0.120. At the moment, there is no information about a newer version that contains a fix for versions 8.5.0 through 8.5.100.